SCS-C02 Security Logging and Monitoring Practice Question
A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used?
⚠ Common exam trap
Many exam-takers confuse AWS Config (which checks compliance of current configurations) with CloudTrail (which records the history of API calls), leading them to select Config for auditing changes instead of CloudTrail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes such as CreatePolicy, PutRolePolicy, and AttachUserPolicy. These events are captured as CloudTrail log entries, which can be audited to track who made the change, when it was made, and from which source IP. CloudTrail is the primary service for auditing and logging all management events across AWS services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configurations and configuration changes as configuration items, but it is designed for compliance assessment and configuration drift, not as a complete API-level audit log. While Config can indicate that an IAM policy or resource changed state, it does not reliably capture the full API request details, user identity, or source IP for every action, and it may not record transient changes that result in no net configuration difference. The authoritative audit trail of who initiated each IAM policy modification comes from CloudTrail management events.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is a monitoring and observability service that collects metrics, logs, and alarms; it does not natively record API activity or maintain an audit trail of IAM policy changes. CloudWatch can only ingest IAM-related events if they are first delivered by AWS CloudTrail, and even then it is a downstream consumer, not the source of truth. For a security team auditing all changes, CloudWatch lacks the per-action, caller-identity, and request-detail history required.
- ✗
IAM Access Analyzer
Why it's wrong here
IAM Access Analyzer continuously analyzes resource-based policies and generates findings about external access from principals outside the account, such as public access or cross-account access. It does not log or record historical changes to IAM policies; it only evaluates current policy definitions and reports potential access risks. Access Analyzer is a security-analysis tool, not a change-audit service, so it cannot answer 'when and by whom was this IAM policy changed?'
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct service because it records management events for all IAM actions, including CreatePolicy, PutRolePolicy, AttachUserPolicy, and DetachUserPolicy, and includes the identity of the caller, the time of the request, source IP, request parameters, and response elements. Management events are logged by default for every region, and you can create a trail to deliver them to S3 for long-term retention and protection with features such as S3 object lock and CloudWatch Logs integration. This gives the security team a complete, chronological audit trail of every IAM policy change.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.